OpenAI’s GPT-6 Cyber found 81 Firefox flaws earlier AI testing missed
OpenAI's GPT-6 Cyber AI model discovered 81 Firefox flaws and 948 Linux kernel vulnerabilities.
Run OpenAI?
Get an email when a reviewed story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
OpenAI has launched GPT-6 Cyber, an AI model designed for authorized security testing. The model successfully identified 81 previously unknown high-severity vulnerabilities in Firefox and helped develop patches. It also found 948 Linux kernel vulnerabilities and demonstrated exploit capabilities for a critical Brotli vulnerability, showcasing its potential in proactive cybersecurity and vulnerability research.
The lesson from this incident
Full lessonOpenAI's GPT-6 Cyber identified 81 high-severity Firefox vulnerabilities and 948 Linux kernel flaws that conventional security testing methods had previously missed, highlighting a significant gap in traditional vulnerability research approaches. This matters because unknown vulnerabilities represent an invisible attack surface — threat actors with access to similar AI capabilities could discover and exploit these flaws before defenders are even aware they exist. The fact that GPT-6 Cyber also demonstrated working exploit development for a critical Brotli vulnerability underscores that AI is now accelerating the arms race between attackers and defenders. Organizations relying solely on periodic manual audits or legacy scanning tools are increasingly outpaced by AI-augmented threat actors. This incident signals that vulnerability management programs must evolve to incorporate AI-assisted testing to remain effective.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.